Skip to content

Commit 414e00f

Browse files
Sagi Maimonjfvogel
authored andcommitted
ptp: ocp: Fix NULL dereference in Adva board SMA sysfs operations
[ Upstream commit e98386d79a23c57cf179fe4138322e277aa3aa74 ] On Adva boards, SMA sysfs store/get operations can call __handle_signal_outputs() or __handle_signal_inputs() while the `irig` and `dcf` pointers are uninitialized, leading to a NULL pointer dereference in __handle_signal() and causing a kernel crash. Adva boards don't use `irig` or `dcf` functionality, so add Adva-specific callbacks `ptp_ocp_sma_adva_set_outputs()` and `ptp_ocp_sma_adva_set_inputs()` that avoid invoking `irig` or `dcf` input/output routines. Fixes: ef61f55 ("ptp: ocp: add Adva timecard support") Signed-off-by: Sagi Maimon <[email protected]> Reviewed-by: Vadim Fedorenko <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Sasha Levin <[email protected]> (cherry picked from commit 8a543d825e78b8d680d8f891381b83fbffdb0bb6) Signed-off-by: Jack Vogel <[email protected]>
1 parent 81daad1 commit 414e00f

File tree

1 file changed

+50
-2
lines changed

1 file changed

+50
-2
lines changed

drivers/ptp/ptp_ocp.c

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2574,12 +2574,60 @@ static const struct ocp_sma_op ocp_fb_sma_op = {
25742574
.set_output = ptp_ocp_sma_fb_set_output,
25752575
};
25762576

2577+
static int
2578+
ptp_ocp_sma_adva_set_output(struct ptp_ocp *bp, int sma_nr, u32 val)
2579+
{
2580+
u32 reg, mask, shift;
2581+
unsigned long flags;
2582+
u32 __iomem *gpio;
2583+
2584+
gpio = sma_nr > 2 ? &bp->sma_map1->gpio2 : &bp->sma_map2->gpio2;
2585+
shift = sma_nr & 1 ? 0 : 16;
2586+
2587+
mask = 0xffff << (16 - shift);
2588+
2589+
spin_lock_irqsave(&bp->lock, flags);
2590+
2591+
reg = ioread32(gpio);
2592+
reg = (reg & mask) | (val << shift);
2593+
2594+
iowrite32(reg, gpio);
2595+
2596+
spin_unlock_irqrestore(&bp->lock, flags);
2597+
2598+
return 0;
2599+
}
2600+
2601+
static int
2602+
ptp_ocp_sma_adva_set_inputs(struct ptp_ocp *bp, int sma_nr, u32 val)
2603+
{
2604+
u32 reg, mask, shift;
2605+
unsigned long flags;
2606+
u32 __iomem *gpio;
2607+
2608+
gpio = sma_nr > 2 ? &bp->sma_map2->gpio1 : &bp->sma_map1->gpio1;
2609+
shift = sma_nr & 1 ? 0 : 16;
2610+
2611+
mask = 0xffff << (16 - shift);
2612+
2613+
spin_lock_irqsave(&bp->lock, flags);
2614+
2615+
reg = ioread32(gpio);
2616+
reg = (reg & mask) | (val << shift);
2617+
2618+
iowrite32(reg, gpio);
2619+
2620+
spin_unlock_irqrestore(&bp->lock, flags);
2621+
2622+
return 0;
2623+
}
2624+
25772625
static const struct ocp_sma_op ocp_adva_sma_op = {
25782626
.tbl = { ptp_ocp_adva_sma_in, ptp_ocp_adva_sma_out },
25792627
.init = ptp_ocp_sma_fb_init,
25802628
.get = ptp_ocp_sma_fb_get,
2581-
.set_inputs = ptp_ocp_sma_fb_set_inputs,
2582-
.set_output = ptp_ocp_sma_fb_set_output,
2629+
.set_inputs = ptp_ocp_sma_adva_set_inputs,
2630+
.set_output = ptp_ocp_sma_adva_set_output,
25832631
};
25842632

25852633
static int

0 commit comments

Comments
 (0)